Skip to content

Commit 1a3ea87

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add support for directly attached and effective tags
docs: clarify comments for tags and effective tags Clients can search resources filtered by effective tags and start to use the new `tags` field instead of old `tag_key`, `tag_value`, `tag_value_id` fields to access directly attached tags. PiperOrigin-RevId: 567554529
1 parent 10516ee commit 1a3ea87

2 files changed

Lines changed: 199 additions & 87 deletions

File tree

‎google/cloud/asset/v1/asset_service.proto‎

Lines changed: 97 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -199,8 +199,7 @@ service AssetService {
199199
}
200200

201201
// Issue a job that queries assets using a SQL statement compatible with
202-
// [BigQuery Standard
203-
// SQL](http://cloud/bigquery/docs/reference/standard-sql/enabling-standard-sql).
202+
// [BigQuery SQL](https://cloud.google.com/bigquery/docs/introduction-sql).
204203
//
205204
// If the query execution finishes within timeout and there's no pagination,
206205
// the full query results will be returned in the `QueryAssetsResponse`.
@@ -209,9 +208,8 @@ service AssetService {
209208
// with the `job_reference` from the a previous `QueryAssets` call.
210209
//
211210
// Note, the query result has approximately 10 GB limitation enforced by
212-
// BigQuery
213-
// https://cloud.google.com/bigquery/docs/best-practices-performance-output,
214-
// queries return larger results will result in errors.
211+
// [BigQuery](https://cloud.google.com/bigquery/docs/best-practices-performance-output).
212+
// Queries return larger results will result in errors.
215213
rpc QueryAssets(QueryAssetsRequest) returns (QueryAssetsResponse) {
216214
option (google.api.http) = {
217215
post: "/v1/{parent=*/*}:queryAssets"
@@ -911,49 +909,73 @@ message SearchAllResourcesRequest {
911909
// Examples:
912910
//
913911
// * `name:Important` to find Google Cloud resources whose name contains
914-
// "Important" as a word.
912+
// `Important` as a word.
915913
// * `name=Important` to find the Google Cloud resource whose name is exactly
916-
// "Important".
914+
// `Important`.
917915
// * `displayName:Impor*` to find Google Cloud resources whose display name
918-
// contains "Impor" as a prefix of any word in the field.
916+
// contains `Impor` as a prefix of any word in the field.
919917
// * `location:us-west*` to find Google Cloud resources whose location
920-
// contains both "us" and "west" as prefixes.
921-
// * `labels:prod` to find Google Cloud resources whose labels contain "prod"
918+
// contains both `us` and `west` as prefixes.
919+
// * `labels:prod` to find Google Cloud resources whose labels contain `prod`
922920
// as a key or value.
923-
// * `labels.env:prod` to find Google Cloud resources that have a label "env"
924-
// and its value is "prod".
925-
// * `labels.env:*` to find Google Cloud resources that have a label "env".
921+
// * `labels.env:prod` to find Google Cloud resources that have a label `env`
922+
// and its value is `prod`.
923+
// * `labels.env:*` to find Google Cloud resources that have a label `env`.
924+
// * `tagKeys:env` to find Google Cloud resources that have directly
925+
// attached tags where the
926+
// [`TagKey`](https://cloud.google.com/resource-manager/reference/rest/v3/tagKeys#resource:-tagkey)
927+
// .`namespacedName` contains `env`.
928+
// * `tagValues:prod*` to find Google Cloud resources that have directly
929+
// attached tags where the
930+
// [`TagValue`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
931+
// .`namespacedName` contains a word prefixed by `prod`.
932+
// * `tagValueIds=tagValues/123` to find Google Cloud resources that have
933+
// directly attached tags where the
934+
// [`TagValue`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
935+
// .`name` is exactly `tagValues/123`.
936+
// * `effectiveTagKeys:env` to find Google Cloud resources that have
937+
// directly attached or inherited tags where the
938+
// [`TagKey`](https://cloud.google.com/resource-manager/reference/rest/v3/tagKeys#resource:-tagkey)
939+
// .`namespacedName` contains `env`.
940+
// * `effectiveTagValues:prod*` to find Google Cloud resources that have
941+
// directly attached or inherited tags where the
942+
// [`TagValue`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
943+
// .`namespacedName` contains a word prefixed by `prod`.
944+
// * `effectiveTagValueIds=tagValues/123` to find Google Cloud resources that
945+
// have directly attached or inherited tags where the
946+
// [`TagValue`](https://cloud.google.com/resource-manager/reference/rest/v3/tagValues#resource:-tagvalue)
947+
// .`name` is exactly `tagValues/123`.
926948
// * `kmsKey:key` to find Google Cloud resources encrypted with a
927-
// customer-managed encryption key whose name contains "key" as a word. This
949+
// customer-managed encryption key whose name contains `key` as a word. This
928950
// field is deprecated. Please use the `kmsKeys` field to retrieve Cloud KMS
929951
// key information.
930952
// * `kmsKeys:key` to find Google Cloud resources encrypted with
931-
// customer-managed encryption keys whose name contains the word "key".
953+
// customer-managed encryption keys whose name contains the word `key`.
932954
// * `relationships:instance-group-1` to find Google Cloud resources that have
933-
// relationships with "instance-group-1" in the related resource name.
955+
// relationships with `instance-group-1` in the related resource name.
934956
// * `relationships:INSTANCE_TO_INSTANCEGROUP` to find Compute Engine
935-
// instances that have relationships of type "INSTANCE_TO_INSTANCEGROUP".
957+
// instances that have relationships of type `INSTANCE_TO_INSTANCEGROUP`.
936958
// * `relationships.INSTANCE_TO_INSTANCEGROUP:instance-group-1` to find
937-
// Compute Engine instances that have relationships with "instance-group-1"
959+
// Compute Engine instances that have relationships with `instance-group-1`
938960
// in the Compute Engine instance group resource name, for relationship type
939-
// "INSTANCE_TO_INSTANCEGROUP".
961+
// `INSTANCE_TO_INSTANCEGROUP`.
940962
// * `state:ACTIVE` to find Google Cloud resources whose state contains
941-
// "ACTIVE" as a word.
963+
// `ACTIVE` as a word.
942964
// * `NOT state:ACTIVE` to find Google Cloud resources whose state doesn't
943-
// contain "ACTIVE" as a word.
965+
// contain `ACTIVE` as a word.
944966
// * `createTime<1609459200` to find Google Cloud resources that were created
945-
// before "2021-01-01 00:00:00 UTC". 1609459200 is the epoch timestamp of
946-
// "2021-01-01 00:00:00 UTC" in seconds.
967+
// before `2021-01-01 00:00:00 UTC`. `1609459200` is the epoch timestamp of
968+
// `2021-01-01 00:00:00 UTC` in seconds.
947969
// * `updateTime>1609459200` to find Google Cloud resources that were updated
948-
// after "2021-01-01 00:00:00 UTC". 1609459200 is the epoch timestamp of
949-
// "2021-01-01 00:00:00 UTC" in seconds.
950-
// * `Important` to find Google Cloud resources that contain "Important" as a
970+
// after `2021-01-01 00:00:00 UTC`. `1609459200` is the epoch timestamp of
971+
// `2021-01-01 00:00:00 UTC` in seconds.
972+
// * `Important` to find Google Cloud resources that contain `Important` as a
951973
// word in any of the searchable fields.
952-
// * `Impor*` to find Google Cloud resources that contain "Impor" as a prefix
974+
// * `Impor*` to find Google Cloud resources that contain `Impor` as a prefix
953975
// of any word in any of the searchable fields.
954976
// * `Important location:(us-west1 OR global)` to find Google Cloud
955-
// resources that contain "Important" as a word in any of the searchable
956-
// fields and are also located in the "us-west1" region or the "global"
977+
// resources that contain `Important` as a word in any of the searchable
978+
// fields and are also located in the `us-west1` region or the `global`
957979
// location.
958980
string query = 2 [(google.api.field_behavior) = OPTIONAL];
959981

@@ -974,10 +996,10 @@ message SearchAllResourcesRequest {
974996
repeated string asset_types = 3 [(google.api.field_behavior) = OPTIONAL];
975997

976998
// Optional. The page size for search result pagination. Page size is capped
977-
// at 500 even if a larger value is given. If set to zero, server will pick an
978-
// appropriate default. Returned results may be fewer than requested. When
979-
// this happens, there could be more results as long as `next_page_token` is
980-
// returned.
999+
// at 500 even if a larger value is given. If set to zero or a negative value,
1000+
// server will pick an appropriate default. Returned results may be fewer than
1001+
// requested. When this happens, there could be more results as long as
1002+
// `next_page_token` is returned.
9811003
int32 page_size = 4 [(google.api.field_behavior) = OPTIONAL];
9821004

9831005
// Optional. If present, then retrieve the next batch of results from the
@@ -990,7 +1012,7 @@ message SearchAllResourcesRequest {
9901012
// the results. The default order is ascending. Add " DESC" after the field
9911013
// name to indicate descending order. Redundant space characters are ignored.
9921014
// Example: "location DESC, name".
993-
// Only singular primitive fields in the response are sortable:
1015+
// Only the following fields in the response are sortable:
9941016
//
9951017
// * name
9961018
// * assetType
@@ -1003,44 +1025,38 @@ message SearchAllResourcesRequest {
10031025
// * state
10041026
// * parentFullResourceName
10051027
// * parentAssetType
1006-
//
1007-
// All the other fields such as repeated fields (e.g., `networkTags`,
1008-
// `kmsKeys`), map fields (e.g., `labels`) and struct fields (e.g.,
1009-
// `additionalAttributes`) are not supported.
10101028
string order_by = 6 [(google.api.field_behavior) = OPTIONAL];
10111029

1012-
// Optional. A comma-separated list of fields specifying which fields to be
1013-
// returned in ResourceSearchResult. Only '*' or combination of top level
1014-
// fields can be specified. Field names of both snake_case and camelCase are
1015-
// supported. Examples: `"*"`, `"name,location"`, `"name,versionedResources"`.
1016-
//
1017-
// The read_mask paths must be valid field paths listed but not limited to
1018-
// (both snake_case and camelCase are supported):
1019-
//
1020-
// * name
1021-
// * assetType
1022-
// * project
1023-
// * displayName
1024-
// * description
1025-
// * location
1026-
// * tagKeys
1027-
// * tagValues
1028-
// * tagValueIds
1029-
// * labels
1030-
// * networkTags
1031-
// * kmsKey (This field is deprecated. Please use the `kmsKeys` field to
1032-
// retrieve Cloud KMS key information.)
1033-
// * kmsKeys
1034-
// * createTime
1035-
// * updateTime
1036-
// * state
1037-
// * additionalAttributes
1038-
// * versionedResources
1039-
//
1040-
// If read_mask is not specified, all fields except versionedResources will
1041-
// be returned.
1042-
// If only '*' is specified, all fields including versionedResources will be
1043-
// returned.
1030+
// Optional. A comma-separated list of fields that you want returned in the
1031+
// results. The following fields are returned by default if not specified:
1032+
//
1033+
// * `name`
1034+
// * `assetType`
1035+
// * `project`
1036+
// * `folders`
1037+
// * `organization`
1038+
// * `displayName`
1039+
// * `description`
1040+
// * `location`
1041+
// * `labels`
1042+
// * `tags`
1043+
// * `effectiveTags`
1044+
// * `networkTags`
1045+
// * `kmsKeys`
1046+
// * `createTime`
1047+
// * `updateTime`
1048+
// * `state`
1049+
// * `additionalAttributes`
1050+
// * `parentFullResourceName`
1051+
// * `parentAssetType`
1052+
//
1053+
// Some fields of large size, such as `versionedResources`,
1054+
// `attachedResources`, `effectiveTags` etc., are not returned by default, but
1055+
// you can specify them in the `read_mask` parameter if you want to include
1056+
// them. If `"*"` is specified, all [available
1057+
// fields](https://cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources#resourcesearchresult)
1058+
// are returned.
1059+
// Examples: `"name,location"`, `"name,versionedResources"`, `"*"`.
10441060
// Any invalid field path will trigger INVALID_ARGUMENT error.
10451061
google.protobuf.FieldMask read_mask = 8
10461062
[(google.api.field_behavior) = OPTIONAL];
@@ -1119,10 +1135,10 @@ message SearchAllIamPoliciesRequest {
11191135
string query = 2 [(google.api.field_behavior) = OPTIONAL];
11201136

11211137
// Optional. The page size for search result pagination. Page size is capped
1122-
// at 500 even if a larger value is given. If set to zero, server will pick an
1123-
// appropriate default. Returned results may be fewer than requested. When
1124-
// this happens, there could be more results as long as `next_page_token` is
1125-
// returned.
1138+
// at 500 even if a larger value is given. If set to zero or a negative value,
1139+
// server will pick an appropriate default. Returned results may be fewer than
1140+
// requested. When this happens, there could be more results as long as
1141+
// `next_page_token` is returned.
11261142
int32 page_size = 3 [(google.api.field_behavior) = OPTIONAL];
11271143

11281144
// Optional. If present, retrieve the next batch of results from the preceding
@@ -1861,8 +1877,8 @@ message QueryAssetsRequest {
18611877
];
18621878

18631879
oneof query {
1864-
// Optional. A SQL statement that's compatible with [BigQuery Standard
1865-
// SQL](http://cloud/bigquery/docs/reference/standard-sql/enabling-standard-sql).
1880+
// Optional. A SQL statement that's compatible with [BigQuery
1881+
// SQL](https://cloud.google.com/bigquery/docs/introduction-sql).
18661882
string statement = 2 [(google.api.field_behavior) = OPTIONAL];
18671883

18681884
// Optional. Reference to the query job, which is from the
@@ -2108,7 +2124,10 @@ message BatchGetEffectiveIamPoliciesResponse {
21082124
// in the original organization policy with some new fields for analysis
21092125
// purpose.
21102126
message AnalyzerOrgPolicy {
2111-
// Represents a rule defined in an organization policy
2127+
// This rule message is a customized version of the one defined in the
2128+
// Organization Policy system. In addition to the fields defined in the
2129+
// original organization policy, it contains additional field(s) under
2130+
// specific circumstances to support analysis results.
21122131
message Rule {
21132132
// The string values for the list constraints.
21142133
message StringValues {
@@ -2542,7 +2561,7 @@ message AnalyzeOrgPolicyGovernedAssetsResponse {
25422561
// The IAM policies governed by the organization policies of the
25432562
// [AnalyzeOrgPolicyGovernedAssetsRequest.constraint][google.cloud.asset.v1.AnalyzeOrgPolicyGovernedAssetsRequest.constraint].
25442563
message GovernedIamPolicy {
2545-
// The full resource name of the resource associated with this IAM policy.
2564+
// The full resource name of the resource on which this IAM policy is set.
25462565
// Example:
25472566
// `//compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1`.
25482567
// See [Cloud Asset Inventory Resource Name

0 commit comments

Comments
 (0)